Privacy Policy

Introduction & Who We Are

Derstock Construction & Wood ("Derstock", "we", "our", or "us") is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit our website, contact us, or engage our services.

This policy is governed by the Protection of Personal Information Act 4 of 2013 (POPIA) of the Republic of South Africa, which came into full effect on 1 July 2021. By using our website or services, you acknowledge that you have read and understood this Privacy Policy.

What Personal Information We Collect

We only collect personal information that is necessary, relevant, and adequate for the purposes described in this policy. The types of personal information we may collect include:

• Contact details — your full name, email address, and phone number (collected when you submit our contact form or request a quote)
• Project information — details about your project type, approximate budget, preferred start date, and project description (voluntarily provided by you)
• Communication records — records of correspondence between you and Derstock via email, WhatsApp, or our website form
• Technical data — your IP address, browser type, device type, pages visited, and time spent on our website (collected automatically via analytics)
• Location data — general geographic location inferred from your IP address

We do not collect sensitive personal information such as race, religion, health information, financial account numbers, or ID numbers through our website.

Why We Collect Your Information (Purpose)

We collect and process your personal information only for the following lawful purposes:

• To respond to your enquiries and requests submitted via our contact form or WhatsApp
• To prepare and send you project quotations and proposals
• To communicate with you about your construction or woodwork project
• To fulfil our contractual obligations when you engage our services
• To improve our website and services based on usage analytics
• To comply with applicable South African laws and regulations
• To send you relevant project updates or service information (only with your consent)

We will not process your personal information for any purpose that is incompatible with the original purpose for which it was collected, unless we obtain your consent or are required to do so by law.

Legal Basis for Processing

Under POPIA, we process your personal information on the following legal grounds:

• Consent — where you have voluntarily provided your information to contact us or request a quote
• Contractual necessity — where processing is necessary to fulfil a contract you have entered into with us
• Legitimate interest — where we have a legitimate business interest (such as improving our services) that does not override your rights
• Legal obligation — where we are required to process your information to comply with South African law

How We Store & Protect Your Information

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against loss, theft, unauthorised access, disclosure, alteration, or destruction.

• Our website uses SSL/TLS encryption to secure data transmitted between your browser and our server
• Access to personal information is restricted to authorised Derstock personnel who need it to perform their job functions
• Contact form submissions are stored securely within our WordPress website hosted on a South African server
• We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law
• Once your information is no longer required, we securely delete or anonymise it

Who We Share Your Information With

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following limited circumstances:

• Service providers — trusted third-party service providers who assist us in operating our website or conducting our business (such as web hosting, email services, or analytics), subject to confidentiality obligations
• Legal requirements — where disclosure is required by law, court order, or government authority
• Business transfers — in the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity, subject to the same privacy protections
• Your consent — any other sharing will only occur with your explicit prior consent

Any third parties with whom we share your information are required to process it in accordance with POPIA and our instructions.

Cookies & Website Analytics

Our website uses cookies and similar tracking technologies to enhance your browsing experience and help us understand how visitors use our site.

• Essential cookies — necessary for the website to function correctly
• Analytics cookies — used to collect anonymous data about how visitors use our site (e.g. Google Analytics)
• Preference cookies — used to remember your settings and preferences

You can control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. By continuing to use our website, you consent to our use of cookies as described in this policy.

Your Rights as a Data Subject (POPIA)

Under the Protection of Personal Information Act (POPIA), you have the following rights regarding your personal information:

To exercise any of these rights, please contact us using the details in Section 01 or the contact box below. We will respond within 30 days.

How to Request Deletion of Your Data

You have the right to request the deletion of your personal information held by Derstock. To submit a deletion request:

• Send an email to info@derstock.co.za with the subject line "Data Deletion Request"
• Include your full name, email address, and a description of the information you would like deleted
• We will acknowledge your request within 5 business days and complete the deletion within 30 days
• We may need to verify your identity before processing the request to protect your security
• Note: some information may need to be retained for legal, tax, or contractual obligations

Cross-Border Data Transfers

We are a South African business and primarily process personal information within South Africa. In the event that any personal information is transferred to a third party outside of South Africa (for example, cloud storage services), we will ensure that the recipient country or organisation provides an adequate level of protection for your personal information, in compliance with Section 72 of POPIA.

Children's Privacy

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a child under 18, please contact us immediately and we will take steps to delete such information promptly.

Information Regulator

If you are not satisfied with how we handle your personal information or a complaint you have submitted to us, you have the right to lodge a complaint with the Information Regulator of South Africa:

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically to stay informed about how we protect your information.

Continued use of our website or services after changes have been made constitutes your acceptance of the updated Privacy Policy.